Security audit

Stock Heat Rank

Security checks for vulnerabilities and agentic risk

Overview

This stock-ranking skill has a coherent purpose, but it runs a large obfuscated JavaScript signer and installs mutable npm dependencies with normal user permissions.

Review before installing. Run it only in a restricted environment, do not use elevated privileges, and be aware that the bundled JavaScript signer and npm dependencies execute locally with your user permissions. Prefer a version with readable signer source, pinned dependencies, a committed lockfile, and documented sandboxing.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

Location: lib/hexin_v.js:1
Finding: Execution of Heavily Obfuscated JavaScript with User-Level Permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: lib/package.json:6
Finding: Non-Reproducible npm Dependency Installation without a Lockfile
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (1164)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose is market-data aggregation, but the skill also directs users to install Node dependencies, run build scripts, and execute precompiled binaries while the markdown itself does not expose the actual data-fetching or ranking logic. This description-behavior mismatch increases supply-chain and review risk because operators may trust a seemingly simple data skill without realizing it introduces additional execution paths and opaque artifacts.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
md
`lib/hexin_v.js` 是问财（同花顺）API的签名生成器，用于生成`Hexin-V`请求头。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
md
`lib/hexin_v.js` 是问财（同花顺）API的签名生成器，用于生成`Hexin-V`请求头。

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Obfuscated Code

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · lib/hexin_v.js (reported line 1)May include surrounding context.
js
var a0_0x4f9ee0=a0_0x45b5;(function(_0x2d51df,_0xd5e931){var _0x1c64eb=a0_0x45b5,_0x581c52=_0x2d51df();while(!![]){try{var _0x276e77=-parseInt(_0x1c64eb(0x51e))/0x1*(-parseInt(_0x1c64eb(0xbd0))/0x2)+parseInt(_0x1c64eb(0xc14))/0x3*(parseInt(_0x1c64eb(0x3ff))/0x4)+parseInt(_0x1c64eb(0xccf))/0x5*(parseInt(_0x1c64eb(0x758))/0x6)+parseInt(_0x1c64eb(0xb1b))/0x7+-parseInt(_0x1c64eb(0x1eb))/0x8*(parseInt(_0x1c64eb(0x522))/0x9)+parseInt(_0x1c64eb(0x291))/0xa*(parseInt(_0x1c64eb(0x418))/0xb)+parseInt(_0x1c64eb(0x71f))/0xc*(-parseInt(_0x1c64eb(0x201))/0xd);if(_0x276e77===_0xd5e931)break;else _0x581c52['push'](_0x581c52['shift']());}catch(_0xcb5e4b){_0x581c52['push'](_0x581c52['shift']());}}}(a0_0xe51c,0xa810e));var a0_0x147791=(function(){var _0x22a1db=!![];return function(_0x41bbf2,_0x3e5a95){var _0x3b1fc8=_0x22a1db?function(){if(_0x3e5a95){var _0x20e0b6=_0x3e5a95['apply'](_0x41bbf2,arguments);return _0x3e5a95=null,_0x20e0b6;}}:function(){};return _0x22a1db=![],_0x3b1fc8;};}()),a0_0x2291c3=a0_0x147791(this,function(){var _0xb712c4=a0_0x45b5,_0x38c6c1={};_0x38c6c1[_0xb712c4(0xbf8)]=_0xb712c4(0x11d);var _0x5c8321=_0x38c6c1;return a0_0x2291c3[_0xb712c4(0x363)]()[_0xb712c4(0x475)](_0x5c8321[_0xb712c4(0xbf8)])[_0xb712c4(0x363)]()[_0xb712c4(0xd2f)](a0_0x2291c3)[_0xb712c4(0x475)](_0x5c8321['hdHOF']);});a0_0x2291c3();const jsdom=require('jsdom'),{JSDOM}=jsdom,{Canvas}=require(a0_0x4f9ee0(0xb10));var a0_0x5a7e01={};a0_0x5a7e01[a0_0x4f9ee0(0xb82)]='https://www.iwencai.com/',a0_0x5a7e01[a0_0x4f9ee0(0xcfc)]=a0_0x4f9ee0(0x381),a0_0x5a7e01['contentType']='text/html',a0_0x5a7e01[a0_0x4f9ee0(0x88e)]=!![],a0_0x5a7e01[a0_0x4f9ee0(0xace)]=0x3e8,a0_0x5a7e01[a0_0x4f9ee0(0x7ff)]=!![];const dom=new JSDOM(a0_0x4f9ee0(0x4f5),a0_0x5a7e01);window=dom[a0_0x4f9ee0(0x757)],document=window[a0_0x4f9ee0(0xa86)],navigator=window[a0_0x4f9ee0(0x7f7)],window[a0_0x4f9ee0(0x385)][a0_0x4f9ee0(0x6ab)]['getContext']=function(_0xe77761){var _0x4c3db7=a0_0x4f9ee0,_0x404578={};_0x404578[_0x4c3db7(0xc29)]=function(_0x16b ...[truncated 28 chars]

Static analysis

No suspicious patterns detected.